Hidden iOS Services Bypass Security

Apple's iPhone and iPad run undisclosed services that allow security features to be bypassed, according to a prominent computer security researcher.

In a presentation at the HOPE/X hacking conference in New York on Friday, forensic researcher Jonathan Zdziarski described several undocumented iOS services that can function backdoors, allowing ostensibly encrypted data to be accessed and subverting user privacy.

Zdziarski in a blog post stresses that he is not accusing Apple of working with the NSA, but he voices suspicion that the NSA might have used some of these services to access data on iOS devices, as described in a recent Der Spiegel report.

"I am not suggesting some grand conspiracy," Zdziarski explains. "There are, however, some services running in iOS that shouldn't be there, that were intentionally added by Apple as part of the firmware, and that bypass backup encryption while copying more of your personal data than ever should come off the phone for the average consumer."

Zdziarski says he hopes Apple will correct the issue because these services should not be present. He claims to have emailed both CEO Tim Cook and former CEO Steve Jobs about these "backdoors," some of which have existed for years, and to have received no response.

In a paper describing his findings, the services com.apple.pcapd and com.apple.mobile.file_relay are among the most questionable code routines that Zdziarski discusses. The former launches a silent packet sniffer that allows the the client to copy the network traffic and HTTP header data coming in and out of the device. The latter accepts a list of requested data sources, and delivers an archive of the data requested, bypassing Apple's built-in backup encryption system in the process.

These services and related ones, which have been augmented over the years by Apple, appear to represent an effort to provide law enforcement agencies with easier access to device data. Yet it's accepted wisdom among computer security experts that backdoors are a bad idea because they're potentially exploitable by anyone -- investigators, intelligence agencies, or cyber criminals.

"When parties communicate using services with [lawful intercept] features, there is an increased likelihood that an unauthorized and/or malicious adversary with the right technical knowledge and access to the system could capture communications contents without detection," a Center for Democracy and Technology report noted last year.

Zdziarski questions why Apple allows a packet sniffer to run on some 600 million iOS devices, why there are undocumented services that bypass user backup encryption, and why most iOS user data is still not encrypted to protect it from Apple.

Apple did not respond to a request for comment.

Nobody wants to be the next data breach headline. But ensuring that cyber-security defenses are operating effectively and efficiently is a monumental challenge given the sheer volume of information coming at us. Here's how to streamline your program. Get the Metrics That Work: Practical Cyber-Security Risk Measurements report today (registration required).

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful ... View Full Bio

But cars, at least those built in the last 15, years DO carry surveillance technology. It's essentially like an airliner "black box" that records all sorts of information about your car, including: speed, acceleration/deceleration, throttle/brake application, steering wheel angle, and various other telemetry data for the last several minutes of travel (I forget how long). Law enforcement often uses this information when analyzing an accident or performing other forensics. And soon insurance companies will give you a discount for carrying a GPS transponder to monitor your speed and location (or, in other words, those who don't want to be monitored will pay more). People gladly accept these things for the sake of convenience and saving money. George Orwell is shaking his head.

It's not acceptable, and if Microsoft or Google were the snooper in question, people would screaming a whole lot louder. Can't say I get the appeal of iThings, but you have to hand it to Apple. It's got some strong Kool-Aid.

People would be up in arms if they learned the home they bought or the car they bought carried surveillance technology that authorities could enable at their convenience. Yet somehow it's acceptable in electronic devices?

Apple says it "designed the iOS platform with security at its core." It sounds like what Apple meant is that it designed the iOS platform with security that can be ignored.

Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps – and it's past time for those with no plans to get cracking.